------------[ cut here ]------------
ODEBUG: activate active (active state 0) object: ffff88806c4ecdd8 object type: rcu_head hint: 0x0
WARNING: CPU: 2 PID: 6790 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 2 UID: 0 PID: 6790 Comm: syz.0.235 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd 40 9c f4 8b 4c 89 e6 48 c7 c7 c0 90 f4 8b e8 ef 56 a7 fc 90 <0f> 0b 90 90 58 83 05 c6 3f b2 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90000538ad8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817a9458
RDX: ffff88802297a440 RSI: ffffffff817a9465 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8bf496e0
R13: ffffffff8b8e9920 R14: 0000000000000000 R15: ffffc90000538b98
FS: 0000000000000000(0000) GS:ffff8880979e7000(0000) knlGS:0000000000000000
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000803d3000 CR3: 000000004ccc3000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x2bc/0x4c0 lib/debugobjects.c:842
debug_rcu_head_queue kernel/rcu/rcu.h:224 [inline]
__call_rcu_common.constprop.0+0x2c/0x9f0 kernel/rcu/tree.c:3067
radix_tree_node_free lib/radix-tree.c:310 [inline]
delete_node+0x1fc/0x8d0 lib/radix-tree.c:573
__radix_tree_delete+0x193/0x3d0 lib/radix-tree.c:1379
radix_tree_delete_item+0xea/0x230 lib/radix-tree.c:1430
afs_cell_destroy+0x1db/0x310 fs/afs/cell.c:522
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0x79c/0x14e0 kernel/rcu/tree.c:2824
handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__rcu_read_unlock+0x11b/0x580 kernel/rcu/tree_plugin.h:445
Code: 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 75 01 00 00 8b 83 44 04 00 00 3d ff ff ff 3f 0f 87 49 01 00 00 5b 5d <41> 5c 41 5d 41 5e e9 1a 3f cb 09 65 8b 1d 63 46 02 12 f7 c3 00 00
RSP: 0018:ffffc90025e86f70 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffffc90025e87aa0 RCX: ffffc90025e86f54
RDX: 0000000000000000 RSI: ffffffff8dbb9080 RDI: ffff88802297a884
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000000137c7 R12: ffff88802297a440
R13: ffffc90025e87000 R14: ffffc90025e87aa0 R15: ffffc90025e87034
rcu_read_unlock include/linux/rcupdate.h:873 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0x3fe/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x160/0x1f0 mm/page_owner.c:156
__reset_page_owner+0x84/0x1a0 mm/page_owner.c:308
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1258 [inline]
free_unref_folios+0x999/0x1630 mm/page_alloc.c:2778
folios_put_refs+0x56f/0x740 mm/swap.c:992
folio_batch_release include/linux/pagevec.h:101 [inline]
shmem_undo_range+0x58f/0x1150 mm/shmem.c:1125
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e3/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/syscall_32.c:309
do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf70ce579
Code: Unable to access opcode bytes at 0xf70ce54f.
RSP: 002b:00000000f50be61c EFLAGS: 00000246 ORIG_RAX: 00000000000000f0
RAX: 0000000000000001 RBX: 00000000f7464f8c RCX: 0000000000000081
RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 14 02 adc $0x2,%al
2: 48 89 f8 mov %rdi,%rax
5: 83 e0 07 and $0x7,%eax
8: 83 c0 03 add $0x3,%eax
b: 38 d0 cmp %dl,%al
d: 7c 08 jl 0x17
f: 84 d2 test %dl,%dl
11: 0f 85 75 01 00 00 jne 0x18c
17: 8b 83 44 04 00 00 mov 0x444(%rbx),%eax
1d: 3d ff ff ff 3f cmp $0x3fffffff,%eax
22: 0f 87 49 01 00 00 ja 0x171
28: 5b pop %rbx
29: 5d pop %rbp
* 2a: 41 5c pop %r12 <-- trapping instruction
2c: 41 5d pop %r13
2e: 41 5e pop %r14
30: e9 1a 3f cb 09 jmp 0x9cb3f4f
35: 65 8b 1d 63 46 02 12 mov %gs:0x12024663(%rip),%ebx # 0x1202469f
3c: f7 .byte 0xf7
3d: c3 ret